Is there any feature or parameter or... that could be set to differentiate at syslog if a login was a real user action or just a admin su. Thanks. Peter. -- Fiat lux! Docendo discimus. _____________________________ 4Many® Services XING: http://www.xing.com/go/invuid/Peter_Russ